The UK Government has recently published a draft legislation called the Data Protection and Digital Information (No.2) Bill, which aims to modernize and strengthen the UK’s data protection laws. The bill follows the UK’s exit from the European Union and is designed to align with the EU’s General Data Protection Regulation (GDPR) while also providing additional protections for UK citizens.
The bill proposes several significant changes to UK data protection laws. One of the most significant changes is the introduction of a new statutory code of practice for data sharing. This code will set out the rules for how public bodies and businesses can share personal data, ensuring that it is done lawfully and ethically. The code is designed to ensure that individuals’ privacy rights are protected while also facilitating data sharing where it is in the public interest.
One of the significant changes proposed in the bill is the requirement that only organizations whose processing activities are likely to pose “high risks” to personal rights and freedoms need to keep processing records. The bill also seeks to allow commercial organizations to benefit from the same freedoms as academics to carry out innovative scientific research, making it easier to reuse data for research purposes.
Another key change proposed in the bill is the expansion of the Information Commissioner’s Office (ICO) powers. The ICO will be given additional powers to fine companies for data breaches and other data protection violations. The maximum fine will be increased from the current £500,000 to 4% of a company’s global turnover or £17.5 million, whichever is greater. The ICO will also be given the power to initiate criminal prosecutions for serious data protection offenses.
The bill also includes measures to strengthen the protection of children’s data. Companies will be required to obtain parental or guardian consent before processing the personal data of children under the age of 16. This requirement is aimed at protecting children’s privacy and preventing them from being targeted by online predators.
Additionally, the bill includes provisions to regulate online advertising. Companies will be required to obtain explicit consent from individuals before using their data for online advertising purposes. The bill also includes measures to tackle online harms, including the spread of disinformation and hate speech.
The DPDI Bill will be a step towards creating a fluid and agile digital economy that prioritizes data protection and privacy. However, its success will depend on its implementation and enforcement. Organizations must assess their data protection compliance strategy and determine which laws apply to their data processing, especially as the bill progresses.
